<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

<head>
	<title>MSN Instant Messenger Protocol - Connecting</title>
	<link rel="stylesheet" href="style.css" type="text/css" />
	<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
	<meta name="description" content="An unofficial overview of the MSN Instant Messenger protocol." />
	<meta name="keywords" content="MSN, Protocol, IM, Messenger, Mike Mintz" />
	<meta name="author" content="Mike Mintz (Michael David Mintz)" />
</head>

<body bgcolor="#FFFFFF">

<br />

<div style="padding: 5pt; margin-left: 10pt; margin-right: 10pt; border-bottom: #AAAAFF solid 1pt" align="right"><font color="#444488"><i>April 23-27, 2002</i> - <b> Version 1 - Draft 2</b></font></div>
<div style="padding: 5pt; margin-left: 10pt; margin-right: 10pt; border-top: #CCCCFF solid 1pt" align="right"><a href="http://www.hypothetic.org/"><small><b>hypothetic.org</b></small></a></div>

<h1>MSN Instant Messenger Protocol</h1>

<div align="center">
	<a href="index.php" class="topic">Overview</a>
	<a href="basics.php" class="topic">Basics</a>
	<a class="topic_selected">Connecting</a>
	<a href="session.php" class="topic">Session</a>
	<a href="messaging.php" class="topic">Messaging</a>
	<a href="filetransfer.php" class="topic">File Transfer</a>
	<a href="other.php" class="topic">Other</a>
	<a href="faq.php" class="topic">FAQ</a>
	<a href="research.php" class="topic">Research</a>
</div>

<h2>Connecting</h2>
	<h3>Dispatch Server</h3>
		<p>The first step of connecting is to connect to the dispatch server. Open a TCP socket and connect to <code>messenger.hotmail.com</code> port <code>1863</code>. When the connection is established, send the <code>VER</code> command, with <code>MSNP7 MSNP6 MSNP5 MSNP4 CVR0</code> (the latest protocol version) as the parameter. Alternatively, use <code>MSNP2</code> to identify as using the original protocol (avoids challenges).</p>
		<p>When a response from the server is received, if the first term of the parameter (not the transaction ID) is not a 0, then the protocol version has been approved. Next, send <code>INF</code> with no parameter to request the authentication protocol from the server.</p>
		<p>Hopefully, the server will respond with a <code>INF</code> command with a parameter of <code>MD5</code>. If the server sends some other parameter, something is wrong. Reply to this with the <code>USR</code> command with <code>MD5 I user@host</code> as the parameter, where <code>user@host</code> is the Passport of the user logging in.</p>
		<p>The server should respond with <code>XFR</code> with the parameter <code>NS W.X.Y.Z:1863 0 A.B.C.D:1863</code>, where <code>W.X.Y.Z:1863</code> is the IP address and port (usually 1863) of the specified notification server and <code>A.B.C.D:1863</code> is the IP address and port of the current server. Close the current connection to the dispatch server and open a new connection to the specified notifcation server.</p>
		<p>Below is an example of a conversation between a client and a dispatch server.</p>
		<p><code class="other">&lt;o&gt; Connect: messenger.hotmail.com 1863</code></p>
		<p><code class="client">&gt;&gt;&gt; VER 0 MSNP7 MSNP6 MSNP5 MSNP4 CVR0</code></p>
		<p><code class="server">&lt;&lt;&lt; VER 0 MSNP7 MSNP6 MSNP5 MSNP4 CVR0</code></p>
		<p><code class="client">&gt;&gt;&gt; INF 1</code></p>
		<p><code class="server">&lt;&lt;&lt; INF 1 MD5</code></p>
		<p><code class="client">&gt;&gt;&gt; USR 2 MD5 I example@passport.com</code></p>
		<p><code class="server">&lt;&lt;&lt; XFR 2 NS 207.46.106.145:1863 0 207.46.104.20:1863</code></p>
		<p><code class="other">&lt;o&gt; Client Disconnects</code></p>
	<h3>Notification Server</h3>
		<p>Connecting to the notification server works exactly the same way as connecting to the dispatch server for the first three steps (everything before the server responds with <code>XFR</code>). When the server receives the user's Passport from <code>USR</code>, it will either reply with an <code>XFR</code> (if the server is overloaded) or another <code>USR</code> with <code>MD5 S #.#</code>, where <code>#.#</code> is an MD5 hash.</p>
		<p>In order to successfully login, a client must support MD5. Respond to this command with another <code>USR</code> with the parameter <code>MD5 S *</code>, where <code>*</code> is the lowercase hexadecimal digest of the MD5 hash received from the server concatenated with the user's login password. Using MD5 ensures that the password is never sent as plaintext.</p>
		<p>The notification server should respond to this with <code>USR</code> with a parameter of <code>OK user@host NAME 1</code>, where <code>user@host</code> is the user's Passport, and <code>NAME</code> is the user's screen name (URL quoted of course). The <code>1</code> represents the fact that the user's Passport account has been verified (via replying to an email). Otherwise, it will be a <code>0</code>. Note that hotmail.com accounts are automatically verified upon signing up. If the login fails, the server will reply with error code <code>911</code>.</p>
		<p>After the login is successful, send <code>CHG</code> with a three letter status code as the parameter. This will set the initial status, and is the final step of logging in. The server should echo your status message back to verify that your status has been set. The official MSN client always logs in with the status code <code>NLN</code>, but the servers allow for any of the 9 statuses. When logging in as <code>FLN</code>, syncing contact lists is the only activity allowed. When logging in as <code>HDN</code>, a client can do anything except for connecting to the switchboard (although it used to be allowed).</p>
		<!-- CVR command -->
		<p>Below is an example of a conversation between a client and a notification server.</p>
		<p><code class="other">&lt;o&gt; Connect: 207.46.106.145 1863</code></p>
		<p><code class="client">&gt;&gt;&gt; VER 3 MSNP7 MSNP6 MSNP5 MSNP4 CVR0</code></p>
		<p><code class="server">&lt;&lt;&lt; VER 3 MSNP7 MSNP6 MSNP5 MSNP4 CVR0</code></p>
		<p><code class="client">&gt;&gt;&gt; INF 4</code></p>
		<p><code class="server">&lt;&lt;&lt; INF 4 MD5</code></p>
		<p><code class="client">&gt;&gt;&gt; USR 5 MD5 I example@passport.com</code></p>
		<p><code class="server">&lt;&lt;&lt; USR 5 MD5 S 1013928519.693957190</code></p>
		<p><code class="client">&gt;&gt;&gt; USR 6 MD5 S 23e54a439a6a17d15025f4c6cbd0f6b5</code></p>
		<p><code class="server">&lt;&lt;&lt; USR 6 OK example@passport.com My%20Screen%20Name 1</code></p>
		<p><code class="client">&gt;&gt;&gt; CHG 7 NLN</code></p>
		<p><code class="server">&lt;&lt;&lt; CHG 7 NLN</code></p>
		<p><code class="other">&lt;o&gt; Continue Session . . .</code></p>
	<h3>Initial Messages</h3>
		<p>After successfully logging in, the MSN servers may send two messages (<code>MSG</code>) over the notification server session. One of them contains the user's Passport profile information. I'm not really sure what the point of it is. The server will also send a new email notification if the user is using a Hotmail account and there are unread emails. These messages may be sent before or after the server verifies your initial status, but I have found that it sends the profile before it verifies your initial status, and it sends the email notification (if there is one) afterwards.</p>
		<p>The profile message has a MIME content type of <code>text/x-msmsgsprofile</code>. The profile information is displayed as part of the MIME header, and the message has no body. Below is an example of what a profile message might look like.</p>
		<p>If your client is behind a NAT firewall (where the actual IP address of the client is hidden), the server will send back two more fields: <code>ClientIP</code> and <code>ClientPort</code>, which are the IP and port the server thinks you're on.</p>
		<p><code class="server">
			MSG Hotmail Hotmail 363<br />
			MIME-Version: 1.0<br />
			Content-Type: text/x-msmsgsprofile; charset=UTF-8<br />
			LoginTime: 1016941010<br />
			EmailEnabled: 1<br />
			MemberIdHigh: 41922<br />
			MemberIdLow: -619232012<br />
			lang_preference: 1033<br />
			preferredEmail: example@passport.com<br />
			country: US<br />
			PostalCode: 12345<br />
			Gender: M<br />
			Kid: 0<br />
			Age:<br />
			sid: 507<br />
			kv: 2<br />
			MSPAuth: 2AAAAAAAADMoV8ORoz64BVwmjtksIg!kmR!Rj5tBBqEaW9hc4YnPHSOQ$$<br />
		</code></p>
		<p>The new email notification message has a MIME content type of <code>text/x-msmsgsinitialemailnotification;</code>. The MIME header only has the two basic lines, and the body of the message displays the number of unread messages, and where to download them (I'm not sure how to use the URLs though). Below is an example of what a new email message might look like.</p>
		<p><code class="server">
			MSG Hotmail Hotmail 223<br />
			MIME-Version: 1.0<br />
			Content-Type: text/x-msmsgsinitialemailnotification; charset=UTF-8<br />
			<br />
			Inbox-Unread: 21<br />
			Folders-Unread: 33<br />
			Inbox-URL: /cgi-bin/HoTMaiL<br />
			Folders-URL: /cgi-bin/folders<br />
			Post-URL: http://www.hotmail.com<br />
		</code></p>
	<h3>Other Server Messages</h3>
		<p>Besides the two initial messages that are received when logging in, the server can also send other types of messages during the session. I have found two of these so far: <code>text/x-msmsgsemailnotification</code> and <code>text/x-msmsgsactivemailnotification</code>. The first one notifies you when a new email has been received. The second notifies you when an email has been deleted (or maybe something else also). Below is an example of a new email being received.</p>
		<p><code class="server">
			MSG Hotmail Hotmail 340<br />
			MIME-Version: 1.0<br />
			Content-Type: text/x-msmsgsemailnotification; charset=UTF-8<br />
			<br />
			From: Mike Mintz<br />
			Message-URL: /cgi-bin/getmsg?msg=MSG1029401739.3&start=1610592&len=402&curmbox=ACTIVE<br />
			Post-URL: https://lc1.law13.hotmail.passport.com/ppsecure/domessengerlogin/EN<br />
			Subject: Hi<br />
			Dest-Folder: ACTIVE<br />
			From-Addr: example@passport.com<br />
			id: 2<br />
		</code></p>
		<p>Below is an example of when I erase a message in my inbox.</p>
		<p><code class="server">
			MSG Hotmail Hotmail 145<br />
			MIME-Version: 1.0<br />
			Content-Type: text/x-msmsgsactivemailnotification; charset=UTF-8<br />
			<br />
			Src-Folder: ACTIVE<br />
			Dest-Folder: trAsH<br />
			Message-Delta: 1<br />
		</code></p>
	<h3>Initial Statuses</h3>
		<p>In addition to profile and new email messages, the server should send you the initial statuses of users on your contact list after successfully logging in. These commands use the command name <code>ILN</code>, and use the transaction ID of your initial status command (<code>CHG</code>). This command has 3 parameters: three letter status code, passport id, and URL quoted screen name. Below are some examples.</p>
		<p><code class="server">
			&lt;&lt;&lt; ILN 7 AWY example@passport.com Mike<br />
			&lt;&lt;&lt; ILN 7 NLN name_123@hotmail.com Name_123<br />
			&lt;&lt;&lt; ILN 7 BSY myname@msn.com My%20Name<br />
		</code></p>
	<h3>Contact List</h3>
		<p>After logging in, a client will usually sync its contact list. This will be explained in the <a href="session.php">session section</a>.</p>

<h1> </h1>

<div align="center">
<small>
Copyright &copy;2002-2003 to <a href="http://www.mikemintz.com/">Mike Mintz</a>.
</small>
</div>

</body>

</html>